openGauss-connector-jdbc vulnerabilities

1 known vulnerability in openGauss-connector-jdbc from openGauss-server. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  openGauss-connector-jdbc: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-111440Oct 19, 2026openGauss-server

  在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logge